- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 190750 CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[openeuler:OLK-6.6 2846/2846] block/blk-io-hierarchy/iodump.c:188:17: error: no member named 'bi_blkg' in 'struct bio'
by kernel test robot 04 Sep '25

04 Sep '25

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 34aca7dce8183a6832361f564e5d70abce03e657 commit: 1bf8f90fb90c600d9f372e6be4ef251cc8905f04 [2846/2846] block-io-hierarchy: core hierarchy stats and iodump implementation config: arm64-randconfig-r121-20250904 (https://download.01.org/0day-ci/archive/20250904/202509041845.IkUFt5vT-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce: (https://download.01.org/0day-ci/archive/20250904/202509041845.IkUFt5vT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509041845.IkUFt5vT-lkp@intel.com/ All errors (new ones prefixed by >>): >> block/blk-io-hierarchy/iodump.c:188:17: error: no member named 'bi_blkg' in 'struct bio' blkg_path(bio->bi_blkg, path, PATH_LEN); ~~~ ^ 1 error generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +188 block/blk-io-hierarchy/iodump.c 179 180 static void __hierarchy_show_bio(struct seq_file *m, struct bio *bio, 181 enum stage_group stage, u64 duration) 182 { 183 char rwbs[RWB_LEN]; 184 char path[PATH_LEN] = {0}; 185 struct task_struct *task = get_pid_task(bio->pid, PIDTYPE_PID); 186 187 blk_fill_rwbs(rwbs, bio->bi_opf); > 188 blkg_path(bio->bi_blkg, path, PATH_LEN); 189 190 seq_printf(m, "%s-%d %s stage %s bio %s %llu + %u cgroup %s started %llu ns ago\n", 191 task ? task->comm : "null", task ? task->pid : 0, 192 bio->bi_bdev->bd_disk->disk_name, 193 hierarchy_stage_name(stage), rwbs, bio->bi_iter.bi_sector, 194 bio_sectors(bio), path, duration); 195 196 if (task) 197 put_task_struct(task); 198 } 199 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/44] Cross-Generation Live Migration
by Jinqian Yang 04 Sep '25

04 Sep '25

Part1: Make CPU ID registers writable by userspace ----------------------------------------------------------------- Patch#1 KVM: arm64: Allow userspace to get the writable masks for feature ID registers Patch#2 KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 KVM: arm64: Use guest ID register values for the sake of emulation Patch#4 KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version Patch#5 KVM: arm64: Reject attempts to set invalid debug arch version Patch#6 KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 Patch#7 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Patch#10 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 KVM: arm64: Document vCPU feature selection UAPIs Patch#12 KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Patch#14 KVM: arm64: Rename is_id_reg() to imply VM scope Patch#15 KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 KVM: arm64: Only reset vCPU-scoped feature ID regs once Patch#17 KVM: arm64: Use read-only helper for reading VM ID registers Patch#18 KVM: arm64: Add helper for writing ID regs Patch#19 KVM: arm64: Treat CTR_EL0 as a VM feature ID register Patch#20 KVM: arm64: rename functions for invariant sys regs Patch#21 KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 KVM: arm64: show writable masks for feature registers Patch#23 KVM: arm64: Make HCX writable from userspace Patch#24 KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Patch#25 arm64: Add support for HIP09 Spectre-BHB mitigation Patch#26 arm64: add cnp verification on Hisilicon erratum 162100125 Patch#27 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Patch#28 KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Patch#29 KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Patch#30 KVM: arm64: Expose S1PIE to guests Patch#31 KVM: arm64: Expose Spec_FPACC to guests Patch#32 KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Patch#33 KVM: arm64: Make AA64PFR1_EL1.NMI writeable Part2: Writable MIDR/REVIDR (and associated baggage) ----------------------------------------------------------------- Patch#34 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#35 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#36 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#37 KVM: arm64: Allow userspace to change the implementation ID registers Part3: Errata management for VM Live migration ----------------------------------------------------------------- Patch#38 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#39 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#40 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#41 arm64: Make _midr_in_range_list() an exported function Patch#42 smccc/kvm_guest: Enable errata based on implementation CPUs Patch#43 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Patch#44 smccc: kvm_guest: Fix kernel builds for 32 bit arm James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Jinqian Yang (2): KVM: arm64: Expose Spec_FPACC to guests KVM: arm64: Make AA64PFR1_EL1.NMI writeable KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Joey Gouly (1): KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Mark Brown (1): KVM: arm64: Expose S1PIE to guests Oliver Upton (14): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reiji Watanabe (1): KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (5): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (8): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 70 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/cputype.h | 40 +- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 36 ++ arch/arm64/include/uapi/asm/kvm.h | 44 ++ arch/arm64/kernel/cpu_errata.c | 88 ++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/image-vars.h | 4 +- arch/arm64/kernel/proton-pack.c | 21 +- arch/arm64/kvm/arm.c | 43 +- arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 +- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 18 +- arch/arm64/kvm/sys_regs.c | 589 +++++++++++++------ arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/smccc/kvm_guest.c | 66 +++ drivers/perf/arm_pmuv3.c | 2 +- include/kvm/arm_pmu.h | 6 + include/linux/arm-smccc.h | 16 + include/uapi/linux/kvm.h | 5 + 29 files changed, 931 insertions(+), 255 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 45

[PATCH OLK-5.10] memcg: introduce memcg early oom feature
by zhaoxuedong 04 Sep '25

04 Sep '25

meituan inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICTXDJ CVE: NA -------------------------------- Introduce memcg early oom feature to trigger OOM killer earlier; this feature is disabled by default. Signed-off-by: Zhao Xuedong <zhaoxuedong(a)meituan.com> --- mm/Kconfig | 14 ++++++++++ mm/vmscan.c | 73 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+) diff --git a/mm/Kconfig b/mm/Kconfig index cc43f5124cb3..89bcb73b6a5b 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -521,6 +521,20 @@ config MEMCG_SWAP_QOS memcg swap control include memory force swapin, swapfile control and swap limit. +config MEMCG_EARLY_OOM + bool "Enable aggressive memcg OOM killing under memory pressure" + depends on MEMCG + depends on X86 || ARM64 + default n + help + MEMCG_EARLY_OOM makes memory cgroups trigger OOM killer earlier + and more aggressively when under memory pressure, rather than + attempting to reclaim very small amounts of file pages through + prolonged reclaim attempts. + + Say "y" if you prefer fast OOM kills over prolonged reclaim + attempts. + config ETMEM_SCAN tristate "module: etmem page scan for etmem support" depends on ETMEM diff --git a/mm/vmscan.c b/mm/vmscan.c index e82d7995b548..622122473f06 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -2470,11 +2470,62 @@ static bool inactive_is_low(struct lruvec *lruvec, enum lru_list inactive_lru) return inactive * inactive_ratio < active; } +#ifdef CONFIG_MEMCG_EARLY_OOM +/* Check if swap usage is over the limit for cgroupv1. */ +static bool is_swap_over_limit(struct mem_cgroup *memcg) +{ + unsigned long mem_limit = READ_ONCE(memcg->memory.max); + unsigned long memsw_limit = READ_ONCE(memcg->memsw.max); + + if (memsw_limit <= mem_limit) + return false; + + return (page_counter_read(&memcg->memsw) - + page_counter_read(&memcg->memory)) > + (memsw_limit - mem_limit); +} + +/* + * Check if file cache is too small to reclaim and anonymous pages are reclaimable. + * Returns true if: + * 1. File cache (+ free space) is below the minimum threshold (pages_min), AND + * 2. Anonymous pages are allowed to be deactivated, AND + * 3. Anonymous pages are abundant relative to reclaim priority + */ +static bool memcg_should_skip_file_reclaim(struct mem_cgroup *memcg, + struct scan_control *sc, + struct lruvec *lruvec) +{ + unsigned long file, anon, free; + unsigned long mem_limit, memsw_usage, mem_high; + unsigned long pages_min; + + if (!cgroup_reclaim(sc)) + return false; + + file = lruvec_lru_size(lruvec, LRU_INACTIVE_FILE, sc->reclaim_idx) + + lruvec_lru_size(lruvec, LRU_ACTIVE_FILE, sc->reclaim_idx); + mem_limit = READ_ONCE(memcg->memory.max); + memsw_usage = page_counter_read(&memcg->memsw); + mem_high = READ_ONCE(memcg->memory.high); + anon = lruvec_lru_size(lruvec, LRU_INACTIVE_ANON, sc->reclaim_idx); + free = mem_limit > memsw_usage ? mem_limit - memsw_usage : 0; + pages_min = mem_limit > mem_high ? (mem_limit - mem_high) >> 2 : 0; + + return (file + free <= pages_min) && + !(sc->may_deactivate & DEACTIVATE_ANON) && + (anon >> sc->priority); +} +#endif + enum scan_balance { SCAN_EQUAL, SCAN_FRACT, SCAN_ANON, SCAN_FILE, +#ifdef CONFIG_MEMCG_EARLY_OOM + SCAN_NONE, +#endif }; /* @@ -2498,6 +2549,20 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, unsigned long ap, fp; enum lru_list lru; +#ifdef CONFIG_MEMCG_EARLY_OOM + /* + * if both file and anon pages are deemed non-reclaimable, + * we deliberately stop reclaiming early to trigger OOM killer + * faster. + */ + if (cgroup_reclaim(sc) && + is_swap_over_limit(memcg) && + memcg_should_skip_file_reclaim(memcg, sc, lruvec)) { + scan_balance = SCAN_NONE; + goto out; + } +#endif + if (sc->not_file) { scan_balance = SCAN_ANON; goto out; @@ -2543,7 +2608,12 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, /* * If the system is almost out of file pages, force-scan anon. */ +#ifdef CONFIG_MEMCG_EARLY_OOM + if (sc->file_is_tiny || + memcg_should_skip_file_reclaim(memcg, sc, lruvec)) { +#else if (sc->file_is_tiny) { +#endif scan_balance = SCAN_ANON; goto out; } @@ -2687,6 +2757,9 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, if ((scan_balance == SCAN_FILE) != file) scan = 0; break; + case SCAN_NONE: + scan = 0; + break; default: /* Look ma, no brain */ BUG(); -- 2.33.0

3 2

[PATCH openEuler-1.0-LTS] x86/smp: ignore reboot IPI when stopping_cpu contains value
by Lin Yujun 04 Sep '25

04 Sep '25

From: Yipeng Zou <zouyipeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ------------------------ Recently, A issue has been reported that CPU hang in x86 VM. The CPU halted during Kdump likely due to IPI issues when one CPU was rebooting and another was in Kdump: CPU0 CPU2 ======================== ====================== reboot Panic machine shutdown Kdump machine shutdown stop other cpus kdump_nmi_shootdown_cpus ... ... local_irq_disable local_irq_disable send_IPIs(REBOOT) [critical regions] [critical regions] 1) send_IPIs(REBOOT) wait timeout 2) send_IPIs(NMI); Halt,NMI context 3) lapic_shutdown [IPI is pending] ... second kernel start 4) init_bsp_APIC [IPI is pending] ... local irq enable Halt, IPI context In simple terms, when the Kdump jump to the second kernel, the IPI that was pending in the first kernel remains and is responded to by the second kernel. As the reboot IPI can only be sent after acquiring @stopping_cpu by storing the CPU number, this case can be detected when @stopping_cpu contains the bootup value -1. Just return and ignore it. Fixes: 9c7af565c58e (“centos 8.1: import linux-4.18.0-147.5.1.el8_1”) Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/x86/kernel/smp.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c index b2b87b91f336..07ccda0ad531 100644 --- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -176,6 +176,29 @@ static int smp_stop_nmi_callback(unsigned int val, struct pt_regs *regs) asmlinkage __visible void smp_reboot_interrupt(void) { ipi_entering_ack_irq(); + + /* + * Handle the case where a reboot IPI is stale in the IRR. This + * happens when: + * + * a CPU crashes with interrupts disabled before handling the + * reboot IPI and jumps into a crash kernel. The reboot IPI + * vector is kept set in the APIC IRR across the APIC soft + * disabled phase and as there is no way to clear a pending IRR + * bit, it is delivered to the crash kernel immediately when + * interrupts are enabled. + * + * As the reboot IPI can only be sent after acquiring @stopping_cpu + * by storing the CPU number, this case can be detected when + * @stopping_cpu contains the bootup value -1. Just return and + * ignore it. + */ + if (atomic_read(&stopping_cpu) == -1) { + pr_info("Ignoring stale reboot IPI\n"); + irq_exit(); + return; + } + cpu_emergency_vmxoff(); stop_this_cpu(NULL); irq_exit(); -- 2.34.1

2 1

[PATCH OLK-6.6 00/44] Cross-Generation Live Migration
by Jinqian Yang 04 Sep '25

04 Sep '25

Part1: Make CPU ID registers writable by userspace ----------------------------------------------------------------- Patch#1 KVM: arm64: Allow userspace to get the writable masks for feature ID registers Patch#2 KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 KVM: arm64: Use guest ID register values for the sake of emulation Patch#4 KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version Patch#5 KVM: arm64: Reject attempts to set invalid debug arch version Patch#6 KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 Patch#7 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Patch#10 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 KVM: arm64: Document vCPU feature selection UAPIs Patch#12 KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Patch#14 KVM: arm64: Rename is_id_reg() to imply VM scope Patch#15 KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 KVM: arm64: Only reset vCPU-scoped feature ID regs once Patch#17 KVM: arm64: Use read-only helper for reading VM ID registers Patch#18 KVM: arm64: Add helper for writing ID regs Patch#19 KVM: arm64: Treat CTR_EL0 as a VM feature ID register Patch#20 KVM: arm64: rename functions for invariant sys regs Patch#21 KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 KVM: arm64: show writable masks for feature registers Patch#23 KVM: arm64: Make HCX writable from userspace Patch#24 KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Patch#25 arm64: Add support for HIP09 Spectre-BHB mitigation Patch#26 arm64: add cnp verification on Hisilicon erratum 162100125 Patch#27 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Patch#28 KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Patch#29 KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Patch#30 KVM: arm64: Expose S1PIE to guests Patch#31 KVM: arm64: Expose Spec_FPACC to guests Patch#32 KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Patch#33 KVM: arm64: Make AA64PFR1_EL1.NMI writeable Part2: Writable MIDR/REVIDR (and associated baggage) ----------------------------------------------------------------- Patch#34 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#35 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#36 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#37 KVM: arm64: Allow userspace to change the implementation ID registers Part3: Errata management for VM Live migration ----------------------------------------------------------------- Patch#38 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#39 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#40 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#41 arm64: Make _midr_in_range_list() an exported function Patch#42 smccc/kvm_guest: Enable errata based on implementation CPUs Patch#43 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Patch#44 smccc: kvm_guest: Fix kernel builds for 32 bit arm James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Jinqian Yang (2): KVM: arm64: Expose Spec_FPACC to guests KVM: arm64: Make AA64PFR1_EL1.NMI writeable KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Joey Gouly (1): KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Mark Brown (1): KVM: arm64: Expose S1PIE to guests Oliver Upton (14): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reiji Watanabe (1): KVM: arm64: Select default PMU in KVM_ARM_VCPU_INIT handler Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (5): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (8): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 70 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/cputype.h | 40 +- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 36 ++ arch/arm64/include/uapi/asm/kvm.h | 44 ++ arch/arm64/kernel/cpu_errata.c | 88 ++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/image-vars.h | 4 +- arch/arm64/kernel/proton-pack.c | 21 +- arch/arm64/kvm/arm.c | 43 +- arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 +- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 18 +- arch/arm64/kvm/sys_regs.c | 589 +++++++++++++------ arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/smccc/kvm_guest.c | 66 +++ drivers/perf/arm_pmuv3.c | 2 +- include/kvm/arm_pmu.h | 6 + include/linux/arm-smccc.h | 16 + include/uapi/linux/kvm.h | 5 + 29 files changed, 931 insertions(+), 255 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 45

[openeuler:OLK-6.6 2846/2846] mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 04 Sep '25

04 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a51e89910d963542ae989c5e4e70cbc0f79ef193 commit: 7d1031b36ebd6c273d9aad316fd9e3e2daa01a85 [2846/2846] mm: support pagecache limit config: arm64-randconfig-r121-20250904 (https://download.01.org/0day-ci/archive/20250904/202509041301.Q6WCrlvW-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce: (https://download.01.org/0day-ci/archive/20250904/202509041301.Q6WCrlvW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509041301.Q6WCrlvW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_cache_limit.c:61:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static? mm/page_cache_limit.c:77:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:103:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/page_cache_limit.c:103:52: sparse: expected void * mm/page_cache_limit.c:103:52: sparse: got void [noderef] __user *buffer >> mm/page_cache_limit.c:94:5: sparse: sparse: symbol 'cache_limit_mbytes_sysctl_handler' was not declared. Should it be static? >> mm/page_cache_limit.c:187:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/page_cache_limit.c:187:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/page_cache_limit.c:187:35: sparse: got int ( * )( ... ) vim +103 mm/page_cache_limit.c 93 > 94 int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, 95 void __user *buffer, size_t *length, loff_t *ppos) 96 { 97 int ret; 98 unsigned long vm_cache_limit_mbytes_max; 99 unsigned long origin_mbytes = vm_cache_limit_mbytes; 100 int nr_retries = MAX_RECLAIM_RETRIES; 101 102 vm_cache_limit_mbytes_max = totalram_pages() >> (20 - PAGE_SHIFT); > 103 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 104 if (ret || !write) 105 return ret; 106 107 if (vm_cache_limit_mbytes > vm_cache_limit_mbytes_max) { 108 vm_cache_limit_mbytes = origin_mbytes; 109 return -EINVAL; 110 } 111 112 if (write) { 113 while (should_reclaim_page_cache() && page_cache_over_limit() && 114 nr_retries--) { 115 if (signal_pending(current)) 116 return -EINTR; 117 118 shrink_memory(node_reclaim_num(), false); 119 } 120 } 121 122 return 0; 123 } 124 125 static void shrink_shepherd(struct work_struct *w) 126 { 127 int node; 128 129 if (!should_periodical_reclaim()) 130 return; 131 132 for_each_online_node(node) { 133 if (!work_pending(&vmscan_works[node])) 134 queue_work_node(node, system_unbound_wq, &vmscan_works[node]); 135 } 136 137 queue_delayed_work(system_unbound_wq, &shepherd, 138 round_jiffies_relative((unsigned long)vm_cache_reclaim_s * HZ)); 139 } 140 141 static void shrink_page_work(struct work_struct *w) 142 { 143 shrink_memory(node_reclaim_num(), true); 144 } 145 146 static void shrink_shepherd_timer(void) 147 { 148 int i; 149 150 for (i = 0; i < MAX_NUMNODES; i++) 151 INIT_WORK(&vmscan_works[i], shrink_page_work); 152 } 153 154 static struct ctl_table page_cache_limit_table[] = { 155 { 156 .procname = "cache_reclaim_s", 157 .data = &vm_cache_reclaim_s, 158 .maxlen = sizeof(vm_cache_reclaim_s), 159 .mode = 0644, 160 .proc_handler = cache_reclaim_sysctl_handler, 161 .extra1 = SYSCTL_ZERO, 162 .extra2 = &vm_cache_reclaim_s_max, 163 }, 164 { 165 .procname = "cache_reclaim_weight", 166 .data = &vm_cache_reclaim_weight, 167 .maxlen = sizeof(vm_cache_reclaim_weight), 168 .mode = 0644, 169 .proc_handler = proc_dointvec_minmax, 170 .extra1 = SYSCTL_ONE, 171 .extra2 = &vm_cache_reclaim_weight_max, 172 }, 173 { 174 .procname = "cache_reclaim_enable", 175 .data = &vm_cache_reclaim_enable, 176 .maxlen = sizeof(vm_cache_reclaim_enable), 177 .mode = 0644, 178 .proc_handler = cache_reclaim_enable_handler, 179 .extra1 = SYSCTL_ZERO, 180 .extra2 = SYSCTL_ONE, 181 }, 182 { 183 .procname = "cache_limit_mbytes", 184 .data = &vm_cache_limit_mbytes, 185 .maxlen = sizeof(vm_cache_limit_mbytes), 186 .mode = 0644, > 187 .proc_handler = cache_limit_mbytes_sysctl_handler, 188 }, 189 }; 190 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] pptp: Fix skb length handling and error path in pptp_xmit()
by Jiacheng Yu 04 Sep '25

04 Sep '25

*** BLURB HERE *** Eric Dumazet (2): pptp: ensure minimal skb length in pptp_xmit() pptp: fix pptp_xmit() error path drivers/net/ppp/pptp.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] wifi: mac80211: reject TDLS operations when station is not associated
by Jiacheng Yu 04 Sep '25

04 Sep '25

From: Moon Hee Lee <moonhee.lee.ca(a)gmail.com> stable inclusion from stable-v6.1.148 commit 0c84204cf0bbe89e454a5caccc6a908bc7db1542 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9N CVE: CVE-2025-38644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 ] syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup. This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid. Reject the operation early if not in station mode or not associated. Reported-by: syzbot+f73f203f8c9b19037380(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380 Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part") Tested-by: syzbot+f73f203f8c9b19037380(a)syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee <moonhee.lee.ca(a)gmail.com> Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/mac80211/tdls.c [ Context conflicts due to f276e20b182d ("wifi: mac80211: move interface config to new struct") not merged, which is depended on by 0c84204cf0bb ] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index 67745d1d4c5d..5d18644aa7a9 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1350,7 +1350,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)) return -ENOTSUPP; - if (sdata->vif.type != NL80211_IFTYPE_STATION) + if (sdata->vif.type != NL80211_IFTYPE_STATION || !sdata->vif.bss_conf.assoc) return -EINVAL; switch (oper) { -- 2.34.1

2 1